Prevail is SOC 2 Type 2 attested, ISO 27001:2022 certified, and holds federal Authorization to Operate. Alongside those certifications, Prevail follows the C.I.A. triad, applying confidentiality, integrity, and availability to every session and transcript on the platform.
We ensure all three elements of data security are met: confidentiality, integrity, and availability.
Confidentiality
Integrity
Availability
Our team works diligently to establish procedures that ensure adherence to industry best practices. Compliance requirements are met and can be confirmed by third-party auditors.
Least privilege
Access should be restricted to only those with a legitimate need and provided in accordance with the principle of least privilege.
Defense-in-depth & zero trust
Security measures should include multiple layers and adhere to defense-in-depth and zero-trust principles during implementation.
Consistency
Consistency in applying security controls should be maintained to ensure uniform implementation throughout all business processes.
Iterative improvement
An iterative approach should be adopted when implementing controls. This approach ensures continuous development across all areas, enhancing effectiveness, auditability, and usability.
Prevail complies with all controls in the American Institute of Certified Public Accountants' System and Organization Controls, specifically the SOC 2, Trust Services Criteria, Type 2. This report addresses internal controls for security, confidentiality, processing integrity, privacy, and availability of customer data.
For a copy of our SOC 2 report, please email security@prevail.ai.
Prevail complies with the International Organization for Standardization's ISO 27001:2022 standard for "establishing, implementing, maintaining and continually improving an information security management system within the context of the organization."
Data in Transit
Data at Rest
Encryption
Employee Access
User Access
Some Prevail Sessions, such as legal proceedings, are subject to US state and federal rules determining availability. Typically, any participant may obtain a recording or transcript of a session at any time, with fees varying by jurisdiction. Prevail maintains storage of this data for at least seven years unless otherwise specified.
Jurisdictional rules
Requesting a copy
Retention
Penetration Testing
Vulnerability Scanning
Endpoint Protection
Education
Access Management
Prevail maintains SOC 2 Type 2 attestation and ISO 27001:2022 certification, holds federal Authorization to Operate, and is pursuing FedRAMP.
The Prevail Platform follows industry best practices to secure data, including encrypting all traffic between user equipment and cloud services, and between individual hosts within cloud services. All data stores that house customer data, including Amazon Web Services (AWS) S3 buckets, are encrypted at rest. Encryption keys are managed via AWS Key Management Service (KMS), which stores key material in Hardware Security Modules (HSMs), preventing direct access by individuals, including Amazon and Vanta employees.
Employee access to customer data is limited to what is directly needed to provide services for customers. Managers and System Administrators have broader access to the extent required by their tasks. All access to customer data and to systems containing customer data is logged and attributable to individual people.
For a copy of our SOC 2 report, please email security@prevail.ai.
To reach Assurance Level 2, Prevail supports either direct Multi-Factor Authentication, or federated Single Sign-On with any OAuth2 or SAML-compliant Identity Provider. This feature is available to both Individual and Enterprise Users free of charge.
Prevail maintains storage of session data for at least seven years unless otherwise specified. Any participant may obtain a recording or transcript of a session at any time, with fees varying by jurisdiction.
Prevail welcomes the assistance of the security community and its diversity of skills, tools, focus, and knowledge to find and mitigate security vulnerabilities in our product. To model best practices in the online legal services industry, we work with HackerOne to manage a bug bounty program.
See also our Terms of Service.